制御システムの動作モードに基づいたネットワーク振舞異常検知方式

抄録

Recently, due to applying standardized technologies and connectivity to the Internet, Industrial Control Systems (ICS) face the threat of cyber attacks. In this paper, we proposed network anomaly detection scheme for ICS to detect cyber attacks for which signatures are not defined. In our proposed scheme, anomaly detection is performed based on the table where running states of ICS and regular communication patterns are matched. We built the ICS testbed and evaluated our proposed scheme. We conducted cyber attacks against the ICS testbed, all the attacks were detected.